Staff Detection Engineer: SIEM, Cloud & Threat Hunting

LinkedIn; Mountain View (CA); Hybrid; USD 156,000 - 255,000; Full time

Benefits offered by this job

Health and wellness programs

Annual performance bonus

Stock options

Benefits

Job summary

LinkedIn is seeking a Staff Information Security Engineer in Detection Engineering to architect and operate high-signal detections across endpoint, identity, cloud, and SaaS. You will lead strategy, mentor peers, and drive measurable improvements in detection efficacy.

Hybrid role based in Mountain View, with on-site collaboration and flexible work. You will partner with IR, Threat Intel, Cloud, IAM, and Product Security to turn hypotheses into production detections, while maintaining telemetry

Qualifications

• 5+ years in security engineering, detection engineering, or incident response.
• 2+ years technical leadership.
• Expertise with log analytics and detection content for SIEM/XDR/EDR and cloud telemetry (AWS/Azure/GCP).

Responsibilities

• Define detection strategy and roadmap; drive coverage across priority threat scenarios and emerging attacks relevant to LinkedIn.
• Partner with IR/Threat Intel/Cloud/IAM to turn hypotheses and TTPs into production detections; lead purple‑team validation.
• Design detections-as-code with version control, CI/CD, unit/integration tests, and staged rollouts.
• Lead adversary emulation exercises to validate detection coverage; develop synthetic signal and test harnesses.
• Proactive threat hunting to discover unknown attacker activity; design hunt playbooks and convert findings into detections.
• Build IR automation (SOAR/Logic Apps) to orchestrate triage, enrichment, containment, and case workflow.
• Operationalize threat intelligence: ingest/normalize IOCs/TTPs, enrich detections with TI context, and collaborate with TI to turn reports into testable hypotheses.
• Build and maintain a SIGMA-based detection content library; translate SIGMA to KQL/SQL where applicable.
• Own telemetry quality: schemas, enrichment, normalization, and data reliability SLIs/SLOs.
• Establish and monitor detection quality metrics (signal-to-noise ratio, precision/recall, false‑positive rate, alert latency, lift); drive continuous tuning.
• Lead incident retros to add resilient post‑incident detections and suppress noisy patterns.
• Mentor engineers; establish standards, code reviews, and guidance for detection engineering best practices.
• Participate in on‑call for critical detection pipelines and high‑severity investigations.

Skills

Detection Engineering

Technical Leadership

KQL/SQL

Detection-as-code

Education

BA/BS in CyberSecurity/InfoSec/CS or related

Tools

SIGMA rules

CI/CD tooling

Python scripting

Job description

LinkedIn is seeking a Staff Information Security Engineer in Detection Engineering to architect and operate high-signal detections across endpoint, identity, cloud, and SaaS. You will lead strategy, mentor peers, and drive measurable improvements in detection efficacy.

Hybrid role based in Mountain View, with on-site collaboration and flexible work. You will partner with IR, Threat Intel, Cloud, IAM, and Product Security to turn hypotheses into production detections, while maintaining telemetry